1 Workshop on Resilient Financial-Information Systems Sponsors: Treasury Dept. and NSF Dates: March 7 and 8, 2005 Location: Treasury Dept. Headquarters, Washington, DC Session Topic: Large-scale ID Theft Session Chairs: Steve Bellovin and Joan Feigenbaum

2 ID Theft in the Financial Industry Essentially not a new problem Large-scale authentication and authorization (A&A) systems are hard to build, deploy, and use. See two relevant NRC reports: Research is ongoing in authentication and authorization. The financial industry should consider participating in it, through academic- industrial partnerships and grants.

3 Some (Known) Goals and Challenges Improve the security of foundation documents. Improve the human-factors aspects of A&A systems. –Need experimental work on how users perceive trust. –Need experimental work on how and why servers accept credentials. –Need work on human-factors aspects of system administration. Provide better ways to create and manage private-public key pairs, e.g., to enable users to control client-side certificates.

4 Goals and challenges (2) Experiment with technology that enables large-scale, asymmetric A&A. Improve regulation and/or liability to require and/or encourage those in a position to prevent ID theft to do so. –Align contol and incentives. –Design network protocols that allow the appropriate incentives to be expressed. Insist that “ID systems” be well defined and well understood; avoid function creep.

5 Goals and challenges (3) Improve understanding of long-lived and infrequently used A&A information. Improve fallback A&A systems, which are currently slow and insecure. The fallback system should be at least as secure as the standard system. Narrow the security gap between computers and their users.

6 Goals and challenges (4) Improve information-sharing capabilities in the context of A&A. –Explore applicability of secure, multiparty protocols in the financial-industry context. –Explore extensions of current trusted- third-party models to information sharing. Are there legal and business barriers?

7 Goals and challenges (5) Improve human interface to and usability of security systems.

8 Phishing is a Problem A large part of the problem is the lack of usable bi-lateral authentication. You can’t trust your computer, and neither can the authenticator. What you see is NOT what you get. The need to test and deploy anti-phishing tools is an opportunity for academic-industrial cooperation. Need large-scale experiments with real systems to evaluate attacks and defenses.

9 Research program structure We need new modes of funding and doing research. Interdisciplinary and cross-sectoral. Propose projects jointly led by researchers, financial-sector professionals, and government program managers. Potential model: NSF digital-government program.